要描述：# |' V. e8 ?, T3 h t
6 h, _4 m, N: F9 E. n3 |
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试6 m2 {; O& H0 k
详细说明：
% ?& P2 D% X+ B& v$ bIslogin //判断登录的方法0 r" D& Z j0 U$ J- {
) g) g2 b- d7 d2 f5 ~
sub islogin()
& k Z9 U' Z) {& X- @
# j: P" v* e7 Z4 D, z; g3 yif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
# [ [ u$ v$ ~* D6 L 9 q" a3 h; |. q4 n! W# [& e
dim t0,t1,t2
1 F3 i* t/ ~! c : g4 O. \1 U# d
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
9 O# k5 I2 Y( m1 v- ^! f: s
: ?" A2 a- \, Kt1=sdcms.loadcookie("islogin")$ q5 a9 p- C' y& ~" X/ d
, m1 w6 J3 t, n; lt2=sdcms.loadcookie("loginkey")* r% n/ X$ `+ O7 T
4 R5 I4 V1 t! @0 F% D6 x' m# J
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
7 B4 l/ B3 k& w( B; X7 h7 { 7 m6 A- K+ q8 n$ }
//
, M( Y0 I W% d6 B3 p # p, w; e" n/ m: E/ X, n' w
sdcms.go "login.asp?act=out"
, Y' i% n e! V/ @2 g
% k [! G# n0 nexit sub
5 z1 T! ~5 y. ]# v6 N% B
2 A+ t8 M/ g7 qelse3 L" l( i: I4 B* h
3 O! t/ ^/ `' {! Z5 x% w5 I. ]
dim data
0 e% B- i: t( ]1 r% n2 x
! f1 C& M7 y1 F, [1 k1 ddata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
# f" P9 Y+ J4 x# v6 h 8 h: b4 ]: N5 U; o# h
if ubound(data)<0 then
' K, b# Q9 ]6 H. ~* x9 _+ q: b( \$ G
n7 _" p8 g6 e" _9 Dsdcms.go "login.asp?act=out". U/ i2 w# B+ h6 F3 {9 d: H
1 y# w& c8 d. H- ^# M& A" _
exit sub
/ l8 }% ?- d1 {2 m. e" d$ R4 ?) Z
* j/ E4 ]& i# selse
: |" @2 Y4 Y/ T. o+ x, c9 c# ~* m
4 a6 h f; [! L2 V O& |( Rif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
% q9 A' _4 D" j) n: s# w
6 ]0 r s$ G! n$ T; asdcms.go "login.asp?act=out"% W% K2 p! p- m" O L1 ]# @% N/ `4 O
& b" e6 D4 I. F+ Kexit sub8 y- D% O, p. Y' R
! p2 @9 ~3 L" B9 u2 U
else1 l$ f7 q8 Y$ k9 z5 c
7 q' p* F2 ^$ c' Wadminid=data(0,0)
/ C$ @: g. S' u' F# ^ 6 r9 V5 C1 Y9 l1 {1 \; E% W( w) x
adminname=data(1,0)
k' n9 r# q% z6 K$ ~. M + x. T: ]0 P: c3 p9 `
admin_page_lever=data(5,0)
. C& a7 Y( f, I. o9 {: S: W6 e . A1 n2 {- Z4 j; G6 i9 D
admin_cate_array=data(6,0)
# {9 u4 A! o ~& L4 E J
6 s% R# `$ r/ a5 }admin_cate_lever=data(7,0)
& U' U& v& ^7 y) x
4 h( ]7 I% b/ {6 ]8 J0 n/ l7 e7 cif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=01 y, T5 U" V3 }
# _3 E+ ?& G$ s+ [
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=00 b# h4 R5 [5 ~* X, H U
- J% `9 Q! `* X5 B& O) u) B7 b
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
% P& K/ L9 X d4 \6 S$ E+ ?: C! Q 2 u3 v7 J" i4 k0 |
if clng(admingroupid)<>0 then
2 Q) |% h6 a; q0 J/ W$ A / Y. ^& k: ?& {2 J1 Y& z* C; l- V* s
admin_lever_where=" and menuid in("&admin_page_lever&")"
' k Y% O5 D; T2 F: K. m" a
! X/ U8 b$ G2 F" i: R; T* \end if7 Q+ p, }! t2 B7 i, ?# H3 G! C
3 n/ u( z7 w; Y3 X# F7 ]3 asdcms.setsession "adminid",adminid
; E# Z3 Z/ z) N " z( k/ Y* I/ t* f- D
sdcms.setsession "adminname",adminname
3 J( R; _8 s' R3 D% b7 M ; E* d. n" W# H$ _8 i
sdcms.setsession "admingroupid",data(4,0)
1 D2 \/ o% ?# I% w0 _2 o* G2 X & |$ H" a( ^* V( {
end if0 j- ? B: R5 i: q$ u( _# {/ l
* \. W4 @$ S. [1 @: {6 oend if
3 \( q/ d: r6 ] . A# N Y& d; J- J
end if) f" W) K' U q2 P6 H) I6 V
: M6 B3 K- `& x T3 P/ _# V8 Oelse
- z! X+ ~- I" z6 A / L' x) v8 T) T7 \
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
, T$ p6 N! d, _ , A$ y5 o$ p) t# \3 D. h% I( }7 c
if ubound(data)<0 then
, j; l0 r* F8 Q# r( a8 c& E6 G$ T 5 J- p9 t, t' }$ K2 y2 [
sdcms.go "login.asp?act=out"0 c2 P+ X1 ^' B7 I/ y" t
% M9 t& |& n, A) q: C0 t4 C5 Kexit sub
4 E5 c: X7 G- k6 y2 L( d, k
1 k: G D# n! X! m5 R$ B9 Velse
9 Y, c5 U3 T* \ 3 Z% g% o7 g7 f1 C8 ~
admin_page_lever=data(0,0)
$ K/ F0 r0 }) j3 j' e
% g8 {# K5 I9 R, V$ c" Iadmin_cate_array=data(1,0)0 X( s1 J3 X* s, }) ~' U; N
# {0 v. }" g/ `. z" a5 j. w# m$ c- ?
admin_cate_lever=data(2,0)
" K5 U3 ?# F. A; A( ~2 n / Y, U g) n+ v' B2 C+ W/ J: Q
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0& v& p. p; l$ g
& }7 L/ ]$ G- Y$ F) u( {( q* uif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0* N) Y/ }9 R$ c i7 Z
9 Y' w/ ?' j/ r4 Q m" o
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
# M: E- ^, `5 I' e# [ ! k. c/ y" h! u% Z3 T5 S; j
if clng(admingroupid)<>0 then
5 s0 { ^# a9 q& s( M/ h- ~7 K
, n+ C, k& B. S' r' p- F( @% V% h1 fadmin_lever_where=" and menuid in("&admin_page_lever&")"7 g- r8 Y, |" n8 ^- O6 v O
$ `' C) ?* k) N) r- B' Z. tend if7 D5 ?& u# r# j+ B: }
: Z( r; J8 s' _6 e1 H' Pend if
7 A) t0 ~! m! o
0 z+ c5 K! c5 t- }/ I7 `end if
% ~. X& z7 {) h Z H
5 c2 x/ w1 K7 S! xend sub
! Q, q% j# z8 ?" Y3 _$ P- s& P漏洞证明：
; g$ M T+ u! X; e9 h看看操作COOKIE的函数4 L9 r- u* R. z
% w& x; D3 ~# L& z: N
public function loadcookie(t0)4 ]4 [5 j* d& \
9 d: H5 g( a5 D' h6 b7 T% W' Aloadcookie=request.cookies(prefix&t0)
7 c8 m& V7 O; V * i! W) B$ v1 E' D! M7 t% x( I
end function
4 e; _2 I8 Y* |4 j
+ p3 m. v: F/ a6 tpublic sub setcookie(byval t0,byval t1)
1 f/ G: {8 C% G, j3 C5 e1 D ?/ E4 n: J5 o5 x% M
response.cookies(prefix&t0)=t1
& g7 i4 v* u5 {0 H 5 q9 h0 Q/ j* `4 o9 T
end sub5 Y0 L9 Z3 v) O$ _- i; ^! r
( G9 ?* o+ z- `% P/ i
prefix
S1 u4 ?, A/ Y! T* \. _; q
! B' C* M* j5 ]* L) I- v+ f; H'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
, K9 Z9 [9 v `- j$ d
; R% X( t* ~! n& m8 S9 ?/ K" {dim prefix# W$ {% P) ?9 K) l8 B
0 E8 _ h7 r' h0 t# F
prefix="1Jb8Ob"$ Z; g9 F+ q7 L6 l& r
; `: t7 ]( w9 _# n# h( c
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
# @2 ?: a6 M8 H* t. z8 l! p1 l ) x% I; v9 ], a; @6 r
sub out$ o' D* a/ v4 g+ O+ w
' r* b0 t* c* k- c
sdcms.setsession "adminid",""
/ w, @; B! N& U+ Q; L ) C0 c( x O- e2 U- \9 A
sdcms.setsession "adminname",""
0 i: ~+ w2 k+ i7 F" M* r0 }' u; e " @. x$ {1 F7 N$ G2 ^# x; ]. o
sdcms.setsession "admingroupid",""
, P$ _5 V. V ^5 G8 H
' M7 R) [ ~9 H8 D) D- [, p% E9 esdcms.setcookie "adminid",""1 G3 o/ G) ]( c3 g/ d% Z' q+ ]5 S
( ]5 T2 x8 s8 |( P0 V
sdcms.setcookie "loginkey",""
7 V: c" `9 ?1 C4 v$ ] ) O- s8 _: x- L& o
sdcms.setcookie "islogin",""! f/ m; N* d0 Z6 S7 E
, R% \( s) g/ x
sdcms.go "login.asp"- J( r' D* M9 D! R
- g% _0 l5 a/ o% _$ fend sub
' e. x6 `) N: w/ G
$ r0 H5 d7 m/ L. P 5 \$ Q9 N, h3 ]6 l- o$ y" I
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
/ ?, E$ P: F8 [: ?* ?- ^6 _' x修复方案：3 u1 g/ X/ a* D0 K
修改函数！
& H" G, q/ [8 }& _! F |
发表于 2013-7-26 12:42:43
收藏
支持
反对